… of just restricting it to a specific time window), but if you are stuck in a package-based world, I believe it's still a major improvement.
Note that ProtectSystem= defaults to "on" now in the initrd, but to "off" on the root fs. Our assumption that we could get away with turning this on for the initrd. Turns out the assumption was wrong, it did break dracut (i.e. fedora's initrd implementation), but this has been fixed now, so we'll leave the default as it is now.